release cut: bump-kind justfile recipe and a compiled, tested cut tool

build.zig

@@ -269,6 +269,37 @@ pub fn build(b: *std.Build) void {
     });
     test_step.dependOn(&b.addRunArtifact(container_check_tests).step);
 
+    // The release cut (specs/release-cut.md). A host tool like the two above,
+    // but run from the build graph rather than installed: it takes a bump kind
+    // on the command line (`zig build cut -- patch`), reads its own token, and
+    // needs the operator's terminal so `git commit -S` can reach pinentry —
+    // none of which a workflow supplies and all of which a Run step passes
+    // through.
+    const cut_tool = hostTool(b, "cut");
+    const cut_run = b.addRunArtifact(cut_tool);
+    // It pushes commits and tags, so it must never be answered from the run
+    // cache, and it must run at the build root whatever directory `zig build`
+    // was invoked from.
+    cut_run.has_side_effects = true;
+    cut_run.stdio = .inherit;
+    cut_run.setCwd(b.path("."));
+    if (b.args) |args| cut_run.addArgs(args);
+    b.step("cut", "Cut a release: preflight, bump, push, wait for CI, signed tag, watch the run")
+        .dependOn(&cut_run.step);
+
+    // Its pure decisions — semver strictness, the zon rewrite, the changelog
+    // section check, the runs-payload read and the tea-config token lookup —
+    // are the reason it is a program rather than a shell script.
+    const cut_tests = b.addTest(.{
+        .name = "cut-tool",
+        .root_module = b.createModule(.{
+            .root_source_file = b.path("tools/cut.zig"),
+            .target = b.graph.host,
+            .optimize = optimize,
+        }),
+    });
+    test_step.dependOn(&b.addRunArtifact(cut_tests).step);
+
     addDist(b, options, admin_assets, .{
         .version = version_option,
         .version_string = version_string,